├── .gitignore
├── .idea
├── codeStyles
│ └── Project.xml
├── gradle.xml
├── misc.xml
└── runConfigurations.xml
├── app
├── .gitignore
├── build.gradle
├── proguard-rules.pro
└── src
│ ├── androidTest
│ └── java
│ │ └── com
│ │ └── example
│ │ └── administrator
│ │ └── myapplication
│ │ └── ExampleInstrumentedTest.java
│ ├── main
│ ├── AndroidManifest.xml
│ ├── assets
│ │ └── fix.dex
│ ├── java
│ │ └── com
│ │ │ └── example
│ │ │ └── administrator
│ │ │ └── myapplication
│ │ │ ├── MainActivity.java
│ │ │ ├── MyApp.java
│ │ │ ├── bug
│ │ │ └── Bug.java
│ │ │ └── utils
│ │ │ ├── AssetsFileUtil.java
│ │ │ ├── ClassLoaderHookHelper.java
│ │ │ └── ReflectionUtil.java
│ └── res
│ │ ├── drawable-v24
│ │ └── ic_launcher_foreground.xml
│ │ ├── drawable
│ │ └── ic_launcher_background.xml
│ │ ├── layout
│ │ └── activity_main.xml
│ │ ├── mipmap-anydpi-v26
│ │ ├── ic_launcher.xml
│ │ └── ic_launcher_round.xml
│ │ ├── mipmap-hdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-mdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-xhdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-xxhdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-xxxhdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── values
│ │ ├── colors.xml
│ │ ├── strings.xml
│ │ └── styles.xml
│ │ └── xml
│ │ └── backup_descriptor.xml
│ └── test
│ └── java
│ └── com
│ └── example
│ └── administrator
│ └── myapplication
│ └── ExampleUnitTest.java
├── build.gradle
├── gradle.properties
├── gradle
└── wrapper
│ ├── gradle-wrapper.jar
│ └── gradle-wrapper.properties
├── gradlew
├── gradlew.bat
└── settings.gradle
/.gitignore:
--------------------------------------------------------------------------------
1 | *.iml
2 | .gradle
3 | /local.properties
4 | /.idea/caches/build_file_checksums.ser
5 | /.idea/libraries
6 | /.idea/modules.xml
7 | /.idea/workspace.xml
8 | .DS_Store
9 | /build
10 | /captures
11 | .externalNativeBuild
12 |
--------------------------------------------------------------------------------
/.idea/codeStyles/Project.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
--------------------------------------------------------------------------------
/.idea/gradle.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
17 |
18 |
--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
19 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
--------------------------------------------------------------------------------
/.idea/runConfigurations.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
11 |
12 |
--------------------------------------------------------------------------------
/app/.gitignore:
--------------------------------------------------------------------------------
1 | /build
2 |
--------------------------------------------------------------------------------
/app/build.gradle:
--------------------------------------------------------------------------------
1 | apply plugin: 'com.android.application'
2 |
3 | android {
4 | compileSdkVersion 28
5 | defaultConfig {
6 | applicationId "com.example.administrator.myapplication"
7 | minSdkVersion 21
8 | targetSdkVersion 28
9 | versionCode 1
10 | versionName "1.0"
11 | testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
12 | }
13 | buildTypes {
14 | release {
15 | minifyEnabled false
16 | proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
17 | }
18 | }
19 | sourceSets { main { assets.srcDirs = ['src/main/assets', 'src/main/assets/'] } }
20 | }
21 |
22 | dependencies {
23 | implementation fileTree(dir: 'libs', include: ['*.jar'])
24 | implementation 'com.android.support:appcompat-v7:28.0.0'
25 | implementation 'com.android.support.constraint:constraint-layout:1.1.3'
26 | testImplementation 'junit:junit:4.12'
27 | androidTestImplementation 'com.android.support.test:runner:1.0.2'
28 | androidTestImplementation 'com.android.support.test.espresso:espresso-core:3.0.2'
29 | }
30 |
--------------------------------------------------------------------------------
/app/proguard-rules.pro:
--------------------------------------------------------------------------------
1 | # Add project specific ProGuard rules here.
2 | # You can control the set of applied configuration files using the
3 | # proguardFiles setting in build.gradle.
4 | #
5 | # For more details, see
6 | # http://developer.android.com/guide/developing/tools/proguard.html
7 |
8 | # If your project uses WebView with JS, uncomment the following
9 | # and specify the fully qualified class name to the JavaScript interface
10 | # class:
11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview {
12 | # public *;
13 | #}
14 |
15 | # Uncomment this to preserve the line number information for
16 | # debugging stack traces.
17 | #-keepattributes SourceFile,LineNumberTable
18 |
19 | # If you keep the line number information, uncomment this to
20 | # hide the original source file name.
21 | #-renamesourcefileattribute SourceFile
22 |
--------------------------------------------------------------------------------
/app/src/androidTest/java/com/example/administrator/myapplication/ExampleInstrumentedTest.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication;
2 |
3 | import android.content.Context;
4 | import android.support.test.InstrumentationRegistry;
5 | import android.support.test.runner.AndroidJUnit4;
6 |
7 | import org.junit.Test;
8 | import org.junit.runner.RunWith;
9 |
10 | import static org.junit.Assert.*;
11 |
12 | /**
13 | * Instrumented test, which will execute on an Android device.
14 | *
15 | * @see Testing documentation
16 | */
17 | @RunWith(AndroidJUnit4.class)
18 | public class ExampleInstrumentedTest {
19 | @Test
20 | public void useAppContext() {
21 | // Context of the app under test.
22 | Context appContext = InstrumentationRegistry.getTargetContext();
23 |
24 | assertEquals("com.example.administrator.myapplication", appContext.getPackageName());
25 | }
26 | }
27 |
--------------------------------------------------------------------------------
/app/src/main/AndroidManifest.xml:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
--------------------------------------------------------------------------------
/app/src/main/assets/fix.dex:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/13217300237/HotUpdateDemo/d1ea548359ed587098377b723fc5986cfd6c72b3/app/src/main/assets/fix.dex
--------------------------------------------------------------------------------
/app/src/main/java/com/example/administrator/myapplication/MainActivity.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication;
2 |
3 | import android.os.Bundle;
4 | import android.support.v7.app.AppCompatActivity;
5 | import android.widget.TextView;
6 |
7 | import com.example.administrator.myapplication.bug.Bug;
8 |
9 | public class MainActivity extends AppCompatActivity {
10 |
11 | @Override
12 | protected void onCreate(Bundle savedInstanceState) {
13 | super.onCreate(savedInstanceState);
14 | setContentView(R.layout.activity_main);
15 |
16 | TextView textView = findViewById(R.id.tv);
17 | Bug bug = new Bug();
18 | String s = bug.getStr();
19 | textView.setText(s);
20 | }
21 | }
22 |
--------------------------------------------------------------------------------
/app/src/main/java/com/example/administrator/myapplication/MyApp.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication;
2 |
3 | import android.app.Application;
4 | import android.content.Context;
5 | import android.os.Build;
6 | import android.util.Log;
7 |
8 | import com.example.administrator.myapplication.utils.AssetsFileUtil;
9 | import com.example.administrator.myapplication.utils.ClassLoaderHookHelper;
10 |
11 | import java.io.File;
12 |
13 |
14 | public class MyApp extends Application {
15 | @Override
16 | protected void attachBaseContext(Context base) {
17 | super.attachBaseContext(base);
18 |
19 | Log.d("BugTag2", "" + getClassLoader());//PathClassLoader
20 | Log.d("BugTag2", "" + getClassLoader().getParent());//BootClassLoader
21 |
22 | String fixPath = "fix.dex";
23 | try {
24 | String path = AssetsFileUtil.copyAssetToCache(this, fixPath);
25 | File fixFile = new File(path);
26 | if (Build.VERSION.SDK_INT >= 23) {
27 | ClassLoaderHookHelper.hookV23(getClassLoader(), fixFile, getCacheDir());
28 | } else if (Build.VERSION.SDK_INT >= 19) {
29 | ClassLoaderHookHelper.hookV19(getClassLoader(), fixFile, getCacheDir());
30 | } else if (Build.VERSION.SDK_INT >= 14) {
31 | ClassLoaderHookHelper.hookV14(getClassLoader(), fixFile, getCacheDir());
32 | }
33 | } catch (Exception e) {
34 | e.printStackTrace();
35 | }
36 |
37 | }
38 | }
39 |
--------------------------------------------------------------------------------
/app/src/main/java/com/example/administrator/myapplication/bug/Bug.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication.bug;
2 |
3 | /**
4 | * 假如说这是一个 出现了bug的类，
5 | */
6 | public class Bug {
7 |
8 | private final static String tag = "BugTag";
9 |
10 | public String getStr() {
11 | return "卧槽，有bug!";
12 | // return "嘿嘿，bug已修复";
13 |
14 | }
15 | }
16 |
--------------------------------------------------------------------------------
/app/src/main/java/com/example/administrator/myapplication/utils/AssetsFileUtil.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication.utils;
2 |
3 | import android.content.Context;
4 | import android.widget.Toast;
5 |
6 | import java.io.File;
7 | import java.io.FileOutputStream;
8 | import java.io.IOException;
9 | import java.io.InputStream;
10 |
11 | public class AssetsFileUtil {
12 |
13 | /**
14 | * 将assets中的文件拷贝到app的缓存目录，并且返回拷贝之后文件的绝对路径
15 | *
16 | * @param context
17 | * @param fileName
18 | * @return
19 | */
20 | public static String copyAssetToCache(Context context, String fileName) {
21 |
22 | File cacheDir = context.getFilesDir();//app的缓存目录
23 | if (!cacheDir.exists()) {
24 | cacheDir.mkdirs();//如果没有缓存目录，就创建
25 | }
26 | File outPath = new File(cacheDir, fileName);//创建输出的文件位置
27 | if (outPath.exists()) {
28 | outPath.delete();//如果该文件已经存在，就删掉
29 | }
30 | InputStream is = null;
31 | FileOutputStream fos = null;
32 | try {
33 | boolean res = outPath.createNewFile();//创建文件，如果创建成功，就返回true
34 | if (res) {
35 | is = context.getAssets().open(fileName);//拿到main/assets目录的输入流，用于读取字节
36 | fos = new FileOutputStream(outPath);//读取出来的字节最终写到outPath
37 | byte[] buf = new byte[is.available()];//缓存区
38 | int byteCount;
39 | while ((byteCount = is.read(buf)) != -1) {//循环读取
40 | fos.write(buf, 0, byteCount);
41 | }
42 | Toast.makeText(context, "加载成功", Toast.LENGTH_SHORT).show();
43 | return outPath.getAbsolutePath();
44 | } else {
45 | Toast.makeText(context, "创建失败", Toast.LENGTH_SHORT).show();
46 | }
47 | } catch (IOException e) {
48 | e.printStackTrace();
49 | } finally {
50 | try {
51 | if (null != fos) {
52 | fos.flush();
53 | fos.close();
54 | }
55 | if (null != is)
56 | is.close();
57 | } catch (IOException e) {
58 | e.printStackTrace();
59 | }
60 | }
61 |
62 | return null;
63 | }
64 | }
65 |
--------------------------------------------------------------------------------
/app/src/main/java/com/example/administrator/myapplication/utils/ClassLoaderHookHelper.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication.utils;
2 |
3 | import java.io.File;
4 | import java.io.IOException;
5 | import java.lang.reflect.Array;
6 | import java.lang.reflect.Field;
7 | import java.lang.reflect.InvocationTargetException;
8 | import java.lang.reflect.Method;
9 | import java.util.ArrayList;
10 | import java.util.List;
11 |
12 | public class ClassLoaderHookHelper {
13 |
14 | //23和19的差别，就是 makeXXXElements 方法名和参数要求不同
15 | //后者是 makeDexElements(ArrayList files, File optimizedDirectory,ArrayList suppressedExceptions)
16 | //前者是 makePathElements(List files, File optimizedDirectory,List suppressedExceptions)
17 | public static void hookV23(ClassLoader classLoader, File outDexFilePath, File optimizedDirectory)
18 | throws IllegalAccessException, InvocationTargetException {
19 | // 1.取得PathClassLoader的pathList的属性
20 | Field pathList = ReflectionUtil.getField(classLoader, "pathList");
21 | // 2.取得PathClassLoader的pathList的属性真实值（得到一个DexPathList对象）
22 | Object dexPathListObj = pathList.get(classLoader);
23 | // 3.获得DexPathList中的dexElements 属性
24 | Field dexElementsField = ReflectionUtil.getField(dexPathListObj, "dexElements");
25 | // 4.获得DexPathList对象中dexElements 属性的真实值
26 | Object[] oldElements = (Object[]) dexElementsField.get(dexPathListObj);
27 |
28 | // 第二阶段
29 | List files = new ArrayList<>();//开始构建makeDexElements的实参
30 | files.add(outDexFilePath);
31 | List ioExceptions = new ArrayList<>();
32 | //获得 DexPathList 的 makePathElements 方法
33 | Method makePathElementsMethod = ReflectionUtil.getMethod(
34 | dexPathListObj, "makePathElements", List.class, File.class, List.class);
35 | assert makePathElementsMethod != null;
36 | //构建出一个新的Element数组
37 | Object[] newElements = (Object[]) makePathElementsMethod.invoke(
38 | null, files, optimizedDirectory, ioExceptions);
39 | //这个方法是静态方法，所以不需要传实例,直接invoke;这里取得的返回值就是 我们外部的dex文件构建成的 Element数组
40 |
41 | //下面把新数组和旧数组合并，注意新数组放前面
42 | Object[] dexElements = null;
43 | if (newElements != null && newElements.length > 0) {
44 | dexElements = (Object[]) Array.newInstance(oldElements.getClass().getComponentType(),
45 | oldElements.length + newElements.length);//先建一个新容器
46 | //这5个参数解释一下, 如果是将A,B 你找AB的顺序组合成数组C，
47 | // 那么参数的含义，依次是 A对象，A数组开始复制的位置，C对象，C对象的开始存放的位置，数组A中要复制的元素个数
48 | System.arraycopy(
49 | newElements, 0, dexElements, 0, newElements.length);//新来的数组放前面
50 | System.arraycopy(
51 | oldElements, 0, dexElements, newElements.length, oldElements.length);
52 | }
53 | //最后把合并之后的数组设置到 dexElements里面
54 | dexElementsField.set(dexPathListObj, dexElements);
55 | }
56 |
57 | public static void hookV19(ClassLoader classLoader, File outDexFilePath, File optimizedDirectory) throws IllegalAccessException, InvocationTargetException {
58 | Field pathList = ReflectionUtil.getField(classLoader, "pathList");//1、获得DexPathList pathList 属性
59 | Object dexPathListObj = pathList.get(classLoader); //2、获得DexPathList pathList对象
60 | Field dexElementsField = ReflectionUtil.getField(dexPathListObj, "dexElements");//3、获得DexPathList的dexElements属性
61 | Object[] oldElements = (Object[]) dexElementsField.get(dexPathListObj);//4、获得pathList对象中 dexElements 的属性值
62 |
63 | List files = new ArrayList<>();//开始构建makeDexElements的实参
64 | files.add(outDexFilePath);
65 | List ioExceptions = new ArrayList<>();
66 | Method makePathElementsMethod = ReflectionUtil.getMethod(//获得 DexPathList 的 makeDexElements 方法
67 | dexPathListObj, "makeDexElements", ArrayList.class, File.class, ArrayList.class);//别忘了后面的参数列表
68 | Object[] newElements = (Object[]) makePathElementsMethod.invoke(
69 | null, files, optimizedDirectory, ioExceptions);//这个方法是静态方法，所以不需要传实例,直接invoke;这里取得的返回值就是 我们外部的dex文件构建成的 Element数组
70 |
71 | //下面把新数组和旧数组合并，注意新数组放前面
72 | Object[] dexElements = null;
73 | if (newElements != null && newElements.length > 0) {
74 | dexElements = (Object[]) Array.newInstance(oldElements.getClass().getComponentType(), oldElements.length + newElements.length);//先建一个新容器
75 | //这5个参数解释一下, 如果是将A,B 你找AB的顺序组合成数组C，那么参数的含义，依次是 A对象，A数组开始复制的位置，C对象，C对象的开始存放的位置，数组A中要复制的元素个数
76 | System.arraycopy(
77 | newElements, 0, dexElements, 0, newElements.length);//新来的数组放前面
78 | System.arraycopy(
79 | oldElements, 0, dexElements, newElements.length, oldElements.length);
80 | }
81 |
82 | //最后把合并之后的数组设置到 dexElements里面
83 | dexElementsField.set(dexPathListObj, dexElements);
84 | }
85 |
86 | //14和19的区别，是这个方法 makeDexElements(ArrayList files,File optimizedDirectory)···它又少了一个参数
87 | public static void hookV14(ClassLoader classLoader, File outDexFilePath, File optimizedDirectory) throws IllegalAccessException, InvocationTargetException {
88 | Field pathList = ReflectionUtil.getField(classLoader, "pathList");//1、获得DexPathList pathList 属性
89 | Object dexPathListObj = pathList.get(classLoader); //2、获得DexPathList pathList对象
90 | Field dexElementsField = ReflectionUtil.getField(dexPathListObj, "dexElements");//3、获得DexPathList的dexElements属性
91 | Object[] oldElements = (Object[]) dexElementsField.get(dexPathListObj);//4、获得pathList对象中 dexElements 的属性值
92 |
93 | List files = new ArrayList<>();//开始构建makeDexElements的实参
94 | files.add(outDexFilePath);
95 | List ioExceptions = new ArrayList<>();
96 | Method makePathElementsMethod = ReflectionUtil.getMethod(//获得 DexPathList 的 makeDexElements 方法
97 | dexPathListObj, "makeDexElements", ArrayList.class, File.class);//别忘了后面的参数列表
98 | Object[] newElements = (Object[]) makePathElementsMethod.invoke(
99 | null, files, optimizedDirectory, ioExceptions);//这个方法是静态方法，所以不需要传实例,直接invoke;这里取得的返回值就是 我们外部的dex文件构建成的 Element数组
100 |
101 | //下面把新数组和旧数组合并，注意新数组放前面
102 | Object[] dexElements = null;
103 | if (newElements != null && newElements.length > 0) {
104 | dexElements = (Object[]) Array.newInstance(oldElements.getClass().getComponentType(), oldElements.length + newElements.length);//先建一个新容器
105 | //这5个参数解释一下, 如果是将A,B 你找AB的顺序组合成数组C，那么参数的含义，依次是 A对象，A数组开始复制的位置，C对象，C对象的开始存放的位置，数组A中要复制的元素个数
106 | System.arraycopy(
107 | newElements, 0, dexElements, 0, newElements.length);//新来的数组放前面
108 | System.arraycopy(
109 | oldElements, 0, dexElements, newElements.length, oldElements.length);
110 | }
111 |
112 | //最后把合并之后的数组设置到 dexElements里面
113 | dexElementsField.set(dexPathListObj, dexElements);
114 | }
115 | }
116 |
--------------------------------------------------------------------------------
/app/src/main/java/com/example/administrator/myapplication/utils/ReflectionUtil.java:
--------------------------------------------------------------------------------
1 | package com.example.administrator.myapplication.utils;
2 |
3 | import java.lang.reflect.Field;
4 | import java.lang.reflect.Method;
5 |
6 | public class ReflectionUtil {
7 |
8 | //得到指定类的指定成员变量 ，兼容该成员在父类中的情况
9 | public static Field getField(Object instance, String fieldName) {
10 | //下面这个，兼容该成员变量在父类中的情况
11 | //解读：初始，clazz是当前类; 循环执行判定 clazz不为空； 变量变化：clazz赋值为它的父类
12 | for (Class clazz = instance.getClass(); clazz != null; clazz = clazz.getSuperclass()) {
13 | try {
14 | Field field = clazz.getDeclaredField(fieldName);//这个只是在本类中去找，如果我要的成员在父类中呢？
15 | if (!field.isAccessible())
16 | field.setAccessible(true);
17 | return field;
18 | } catch (NoSuchFieldException e) {
19 | // e.printStackTrace();
20 | }
21 | }
22 | return null;
23 | }
24 |
25 | //得到指定类的指定成员方法 ，兼容该成员在父类中的情况
26 | public static Method getMethod(Object instance, String methodName, Class... args) {
27 | //下面这个，兼容该成员变量在父类中的情况
28 | //解读：初始，clazz是当前类; 循环执行判定 clazz不为空； 变量变化：clazz赋值为它的父类
29 | for (Class clazz = instance.getClass(); clazz != null; clazz = clazz.getSuperclass()) {
30 | try {
31 | Method method = clazz.getDeclaredMethod(methodName, args);//这个只是在本类中去找，如果我要的成员在父类中呢？
32 | if (!method.isAccessible())
33 | method.setAccessible(true);
34 | return method;
35 |
36 | } catch (NoSuchMethodException e) {
37 | // e.printStackTrace();
38 | }
39 | }
40 | return null;
41 | }
42 |
43 |
44 | }
45 |
--------------------------------------------------------------------------------
/app/src/main/res/drawable-v24/ic_launcher_foreground.xml:
--------------------------------------------------------------------------------
1 |
7 |
12 |
13 |
19 |